import React, { useEffect, useMemo, useRef, useState } from 'react'; import { useSearchParams, useNavigate } from 'react-router-dom'; import { Archive, Search, ChevronLeft, ChevronRight, Filter, Key, Package, ChevronRight as ChevR, Target, FileText, Mail, } from '../icons'; import api from '../utils/api'; import BountyInspector from './BountyInspector'; import EmptyState from './EmptyState/EmptyState'; import { useFocusSearch } from '../hooks/useFocusSearch'; import './Dashboard.css'; import './Bounty.css'; interface BountyEntry { id: number; timestamp: string; decky: string; service: string; attacker_ip: string; bounty_type: string; payload: any; } const FINGERPRINT_LABELS: Record = { fingerprint_type: 'TYPE', ja3: 'JA3', ja3s: 'JA3S', ja4: 'JA4', ja4s: 'JA4S', ja4l: 'JA4L', sni: 'SNI', alpn: 'ALPN', dst_port: 'PORT', mechanisms: 'MECHANISM', raw_ciphers: 'CIPHERS', hash: 'HASH', target_ip: 'TARGET', target_port: 'PORT', ssh_banner: 'BANNER', kex_algorithms: 'KEX', encryption_s2c: 'ENC (S→C)', mac_s2c: 'MAC (S→C)', compression_s2c: 'COMP (S→C)', raw: 'RAW', ttl: 'TTL', window_size: 'WINDOW', df_bit: 'DF', mss: 'MSS', window_scale: 'WSCALE', sack_ok: 'SACK', timestamp: 'TS', options_order: 'OPTS ORDER', }; const FingerprintPreview: React.FC<{ payload: any }> = ({ payload }) => { if (!payload || typeof payload !== 'object') { return {JSON.stringify(payload)}; } const keys = Object.keys(payload); const priority = ['fingerprint_type', 'ja3', 'ja4', 'hash', 'sni', 'target_ip', 'ssh_banner']; const show = priority.filter(k => payload[k] !== undefined && payload[k] !== null).slice(0, 2); if (!show.length) { return {keys.slice(0, 3).join(', ')}; } return ( {show.map(k => `${FINGERPRINT_LABELS[k] || k.toUpperCase()}: ${payload[k]}`).join(' · ')} ); }; const Bounty: React.FC = () => { const navigate = useNavigate(); const [searchParams, setSearchParams] = useSearchParams(); const query = searchParams.get('q') || ''; const typeFilter = searchParams.get('type') || ''; const page = parseInt(searchParams.get('page') || '1'); const [bounties, setBounties] = useState([]); const [total, setTotal] = useState(0); const [loading, setLoading] = useState(true); const [searchInput, setSearchInput] = useState(query); const searchRef = useRef(null); useFocusSearch(searchRef); const [selected, setSelected] = useState(null); const [sortCol, setSortCol] = useState(''); const [sortDir, setSortDir] = useState<'asc' | 'desc'>('asc'); const limit = 50; const fetchBounties = async () => { setLoading(true); try { const offset = (page - 1) * limit; let url = `/bounty?limit=${limit}&offset=${offset}`; if (query) url += `&search=${encodeURIComponent(query)}`; const apiType = typeFilter === 'mail' ? 'artifact' : typeFilter; if (apiType) url += `&bounty_type=${apiType}`; const res = await api.get(url); setBounties(res.data.data); setTotal(res.data.total); } catch (err) { console.error('Failed to fetch bounties', err); } finally { setLoading(false); } }; useEffect(() => { fetchBounties(); }, [query, typeFilter, page]); const handleSearch = (e: React.FormEvent) => { e.preventDefault(); setSearchParams({ q: searchInput, type: typeFilter, page: '1' }); }; const setPage = (p: number) => setSearchParams({ q: query, type: typeFilter, page: p.toString() }); const setType = (t: string) => setSearchParams({ q: query, type: t, page: '1' }); const totalPages = Math.max(1, Math.ceil(total / limit)); const fpCount = bounties.filter(b => b.bounty_type === 'fingerprint').length; const artCount = bounties.filter(b => b.bounty_type === 'artifact' && b.payload?.kind !== 'mail').length; const mailCount = bounties.filter(b => b.bounty_type === 'artifact' && b.payload?.kind === 'mail').length; const handleSortCol = (col: string) => { if (sortCol === col) { if (sortDir === 'asc') setSortDir('desc'); else { setSortCol(''); setSortDir('asc'); } } else { setSortCol(col); setSortDir('asc'); } }; const filteredBounties = useMemo(() => { if (typeFilter !== 'mail') return bounties; return bounties.filter(b => b.bounty_type === 'artifact' && b.payload?.kind === 'mail'); }, [bounties, typeFilter]); const sortedBounties = useMemo(() => { if (!sortCol) return filteredBounties; return [...filteredBounties].sort((a, b) => { let av: string | number = ''; let bv: string | number = ''; if (sortCol === 'time') { av = a.timestamp; bv = b.timestamp; } else if (sortCol === 'decky') { av = a.decky; bv = b.decky; } else if (sortCol === 'svc') { av = a.service; bv = b.service; } else if (sortCol === 'attacker') { av = a.attacker_ip; bv = b.attacker_ip; } else if (sortCol === 'type') { av = a.bounty_type; bv = b.bounty_type; } const cmp = String(av).localeCompare(String(bv)); return sortDir === 'asc' ? cmp : -cmp; }); }, [filteredBounties, sortCol, sortDir]); const SortTh: React.FC<{ col: string; children: React.ReactNode }> = ({ col, children }) => ( handleSortCol(col)} > {children} {sortCol === col ? (sortDir === 'asc' ? ' ▲' : ' ▼') : ''} ); const SEGMENTS: [string, string][] = [ ['', 'ALL'], ['artifact', 'ARTIFACTS'], ['fingerprint', 'FINGERPRINTS'], ['mail', 'EMAIL'], ]; const formatBytes = (n: any): string => { const v = typeof n === 'string' ? parseInt(n, 10) : n; if (!Number.isFinite(v) || v < 0) return ''; if (v < 1024) return `${v} B`; if (v < 1024 * 1024) return `${(v / 1024).toFixed(1)} KB`; return `${(v / (1024 * 1024)).toFixed(1)} MB`; }; return (

BOUNTY VAULT

{total.toLocaleString()} BOUNTIES · {artCount} ARTIFACTS · {fpCount} FINGERPRINTS · {mailCount} EMAIL
setSearchInput(e.target.value)} />
{SEGMENTS.map(([v, l]) => ( ))}
{total.toLocaleString()} ARTIFACTS CAPTURED
Page {page} of {totalPages}
TIMEDECKYSVCATTACKERTYPE {sortedBounties.length > 0 ? sortedBounties.map(b => { const isCred = b.bounty_type === 'credential'; const isFp = b.bounty_type === 'fingerprint'; const isArt = b.bounty_type === 'artifact'; const isMail = isArt && b.payload?.kind === 'mail'; const Icon = isCred ? Key : isMail ? Mail : isArt ? FileText : Package; return ( setSelected(b)}> ); }) : ( )}
DATA
{new Date(b.timestamp).toLocaleTimeString()} {b.decky} {b.service} { e.stopPropagation(); navigate(`/attackers?q=${encodeURIComponent(b.attacker_ip)}`); }} > {b.attacker_ip} {b.bounty_type.toUpperCase()} {isCred ? (
user:{b.payload?.username ?? '—'} pass: {b.payload?.password ?? '—'}
) : isFp ? ( ) : isMail ? ( {b.payload?.subject || '(no subject)'} {b.payload?.mail_from && ( from {b.payload.mail_from} )} {b.payload?.attachment_count > 0 && ( · {b.payload.attachment_count} attach )} {b.payload?.size != null && ( · {formatBytes(b.payload.size)} )} ) : isArt ? ( {b.payload?.orig_path || b.payload?.stored_as || '—'} {b.payload?.size != null && ( {formatBytes(b.payload.size)} )} {b.payload?.attribution && ( · via {b.payload.attribution} )} ) : ( {b.payload?.query || b.payload?.body || b.payload?.command || JSON.stringify(b.payload)} )}
{selected && ( setSelected(null)} onSelectAttacker={(ip) => { setSelected(null); navigate(`/attackers?q=${encodeURIComponent(ip)}`); }} /> )}
); }; export default Bounty;